Add GitHub Actions workflow to publish server to MCP Registry

[jmagar]

Goal

Add a GitHub Actions workflow that publishes generated/template MCP server metadata to the official MCP Registry during release.

Current facts

• The official guide recommends publishing from GitHub Actions after release/tag creation.
• mcp-publisher is the official registry CLI.
• GitHub OIDC is the preferred authentication path in CI.
• The workflow needs id-token: write permissions for OIDC.
• Registry publishing validates server.json package metadata and the published package/artifact it points to.

Requirements

• Add a release-tag-triggered workflow for publishing server metadata.
• Run tests and build/package checks before registry publication.
• Install the official mcp-publisher binary from the Model Context Protocol registry releases.
• Authenticate with the MCP Registry using GitHub OIDC by default.
• Set id-token: write permissions for OIDC authentication.
• Support version injection into server.json from the release tag when needed.
• Publish with mcp-publisher publish after package/publication prerequisites are satisfied.
• Document optional auth alternatives:
  • GitHub PAT via MCP_GITHUB_TOKEN with read:org and read:user scopes.
  • DNS auth via MCP_PRIVATE_KEY Ed25519 key.
• Coordinate with npm/package release work so registry package validation can find public installation metadata.

Implementation phases

1. Validate registry manifest shape.

   • Audit current server.json template and generated service server.json output.
   • Decide whether template repo publishes its own server or only generated repos publish.
   • Add a local/CI validation command for mcp-publisher validate if supported by the installed CLI.

2. Add workflow skeleton.

   • Trigger on release publication or semver tags, matching Implement release-please across template release surfaces #72 release-please outputs.
   • Add permissions: contents: read and id-token: write at minimum.
   • Download/install pinned mcp-publisher release artifact with checksum if available.

3. Gate publication.

   • Require tests/build/package checks before publish.
   • Ensure Create Node distribution package with npx MCP launch support #73 npm package, Create MCPB bundle template for generated local servers #80 MCPB artifact, or other declared package target is already publicly reachable before registry publish.
   • Verify server.json version equals the release tag/component version.

4. Publish.

   • Run mcp-publisher login github-oidc or equivalent current auth command.
   • Run mcp-publisher publish against the intended server.json.
   • Upload logs/artifacts useful for debugging failed validation.

5. Document and scaffold.

   • Document required secrets and permissions.
   • Generate this workflow for scaffolded repos only when registry publishing is selected.

Alignment with related issues

• Implement release-please across template release surfaces #72 owns release creation/version updates that should trigger this workflow.
• Create Node distribution package with npx MCP launch support #73 may provide the npm package target referenced by server.json.
• Create MCPB bundle template for generated local servers #80 may provide .mcpb artifacts, but MCPB artifact creation is separate from registry publishing.
• Add crates.io publishing infrastructure for public reusable crates #71 owns Rust package checks that may be a prerequisite for publish validation.

Local files likely touched

• .github/workflows/mcp-registry-publish.yml
• server.json
• docs/MCP-REGISTRY-PUBLISH-GUIDE.md or equivalent registry docs
• release/components.toml
• xtask/src/* if adding validation/version sync helpers
• Generated scaffold workflow/templates

Risks

• Publishing can fail if package metadata points to artifacts not yet public.
• GitHub OIDC permissions are easy to under-specify or over-grant.
• Registry CLI commands/flags may change; pinning and validation docs must match current CLI.
• Template publishing and generated-repo publishing may need different workflow defaults.

Acceptance criteria

• Workflow exists under .github/workflows/ and runs on release tags or release publication events chosen by Implement release-please across template release surfaces #72.
• Workflow has least-privilege permissions including id-token: write for OIDC.
• Workflow runs tests/build/package checks before publishing.
• Workflow installs mcp-publisher, authenticates with GitHub OIDC, and publishes the server metadata.
• server.json version and package metadata are checked or updated from the release tag.
• Docs explain required repo secrets and troubleshooting for auth/package validation failures.
• Dry-run or non-production validation path exists for PRs where feasible.

Sources

• Official GitHub Actions registry guide: https://modelcontextprotocol.io/registry/github-actions
• Registry overview: https://modelcontextprotocol.io/registry/about
• Registry repository: https://github.com/modelcontextprotocol/registry
• Local registry manifest template: /home/jmagar/workspace/rmcp-template/server.json